Privacy Policy
Personal data processing under the Law of the Republic of Uzbekistan “On Personal Data” No. ZRU-547
Last updated: 19.08.2026
OKS TOURS LLC (hereinafter the “Company” or the “Operator”) respects your privacy and undertakes to provide reliable protection of your personal data. This Privacy Policy (the “Policy”) has been drawn up in accordance with the Law of the Republic of Uzbekistan “On Personal Data” No. ZRU-547 of 02.07.2019 and defines how information provided by Users and Clients is collected, organised, used, stored, transferred and protected — when using the Company’s website, official messengers and communication channels, and when submitting requests, booking and issuing air tickets, and concluding and performing contracts for tourism and related services.
1. Categories of personal data collected
When you use the Website, and in connection with the conclusion and performance of the Public Offer (Contract for tourism services) and pre-contractual communication, the Company processes the following categories of personal data. 1.1. Identification and passport data: • Surname, first name and patronymic (including the Latin transliteration as shown in the international passport); • Date and place of birth, gender, citizenship; • Identity document details (series, number, date of issue, issuing authority, validity period of the domestic and international passports); • Personal identification number (PINFL) / TIN, where required. 1.2. Contact data: • Mobile or landline phone number, e-mail address, messenger handles (Telegram and others), actual place of residence and registered address. 1.3. Tour parameters and trip details: • Dates, destinations and itinerary details; • Transport booking data (flights, travel classes, baggage details); • Accommodation details (hotels, room categories, meal plans); • Insurance policies, excursions and additional services; • Special preferences, including medical or dietary requirements voluntarily provided by the Client; • History of orders, cancellations and booking changes, and emergency contact details. 1.4. Visa information and documents: • Details of current and previous visas, and travel history; • Documents required for submission to consular institutions and visa centres (employment certificates, bank statements, photographs). 1.5. Data of minors and third parties (co-travellers): • Personal data of persons travelling together with the Customer, including minor children. Customer’s warranty: by providing data of third parties and/or minors, the Customer warrants that they are the legal representative of such persons or have obtained their express written consent to transfer their personal data to the Company and the Company’s counterparties on the terms of this Policy. 1.6. Payment data and transaction metadata: • Payer name, amount, currency, date and order number. Isolation of financial data: the Company does NOT collect, does NOT process and does NOT store full bank card numbers (PAN) or CVV/CVC codes. These details are entered directly on the secure, PCI DSS certified payment page of the Octobank processing centre. 1.7. Technical data and information about use of the Website: • IP address, cookie data, browser type and version, operating system, device identifiers, geolocation, page visit history and session duration. 1.8. Responsibility for the accuracy and currency of data: The User/Client bears full legal and financial responsibility for the accuracy, correctness, completeness and currency of all personal data provided to the Company — including the correct Latin transliteration of names and the numbers, series and validity dates of passports, both their own and those of co-travellers. The Company is not liable for a disrupted trip, visa refusal, booking cancellation, denial of carriage or any other adverse consequence or financial loss arising from the Client providing inaccurate, incorrect, outdated or erroneous data.
2. Purposes of personal data processing
Personal data is processed solely to achieve specific, predetermined and lawful purposes. 2.1. Conclusion and performance of the contract for tourism services: • Arranging and booking tourism services: booking and issuing transport documents (air and rail tickets in accordance with the Air Code of the Republic of Uzbekistan and IATA regulations), booking accommodation, transfers, excursions and other services; • Visa support: preparing and submitting document packages to embassies, consular institutions and accredited visa centres; • Insurance: transferring data to insurance companies to issue medical and trip-cancellation insurance policies; • Communication: contacting the Client about booking status, schedule changes, entry rules and force majeure situations. 2.2. Compliance with the law and protection of the Company’s interests: • Financial and tax accounting: processing payments, issuing primary accounting documents and completion certificates, and complying with the currency and tax legislation of Uzbekistan; • Security and fraud prevention: verifying transactions and protecting the Company’s resources against unauthorised access; • Claims and litigation: protecting the rights and legitimate interests of the Company, preparing responses to enquiries and claims, pre-trial dispute settlement, and representation before judicial and supervisory authorities. 2.3. Operation of the Website and improvement of service quality: • Processing online requests received through the Website and official communication channels; • Analytics and personalisation: analysing user experience and improving the Website and service quality; • Marketing communications: sending news, special offers and promotional materials.
3. Security, storage and destruction of data
3.1. Database localisation: Collection, organisation and storage of personal data of citizens of the Republic of Uzbekistan is carried out using databases physically located in the territory of the Republic of Uzbekistan. 3.2. Data protection measures: • Organisational measures: appointment of a person responsible for personal data processing; adoption of internal local regulations; access rights granted to employees on a need-to-know basis; regular staff briefings; • Technical measures: SSL/TLS encryption for data transmitted through the Website; firewalls and antivirus systems; electronic logging of actions performed on data; • Payment security: bank cards are processed on the PCI DSS certified side of the Octobank processing centre. The Company does not request, process or store full card details (PAN, CVV/CVC). 3.3. Retention periods and destruction procedure: • Personal data is stored in a form that allows the data subject to be identified for no longer than the purposes set out in Section 2 of this Policy require, or until the Client withdraws consent; • Data on financial transactions, certificates and primary accounting documents is kept for 5 (five) years in accordance with the tax and accounting legislation of Uzbekistan; • Once the processing purposes are achieved, the retention period expires or consent is withdrawn, personal data is destroyed or anonymised within 30 (thirty) calendar days, unless the legislation of Uzbekistan provides otherwise. 3.4. Limitation of liability: The Company takes all reasonable and sufficient measures to protect data, but is not liable: • For loss or disclosure of personal data caused by unlawful acts of third parties (cyberattacks, unauthorised access to the Client’s device) or by the Client’s own actions; • For losses, missed departures, refusal of visa support or booking errors arising because the Client provided inaccurate, erroneous or incomplete personal data.
4. Rights of the personal data subject
4.1. The Client’s rights: Under the Law of the Republic of Uzbekistan “On Personal Data”, the Client has the right to: • receive information concerning the processing of their personal data; • demand clarification, blocking or destruction of their data where it is incomplete, outdated, inaccurate or unlawfully obtained; • withdraw consent to data processing previously given; • appeal against unlawful actions of the Company to the authorised body or to a court. 4.2. How to submit a request: To exercise these rights, the Client sends an official request to the Company’s e-mail address: support@okstours.com, or by post to the Company’s registered address. The request must state the Client’s full name, the series and number of their identity document, information confirming their relationship with the Company (contract or booking number), and the Client’s signature. The Company may request additional information to identify the applicant. 4.3. Response times: The Client’s request is reviewed by the Company within 15 (fifteen) calendar days of receipt. 4.4. Limits on deletion and withdrawal of consent: Withdrawal of consent or a demand for destruction of data does not apply where processing is necessary: • to perform a current Contract for tourism services — until the trip is completed and settlements are made; • to fulfil obligations imposed on the Company by the legislation of Uzbekistan, including the 5-year retention of primary documents; • to protect the rights and legitimate interests of the Company in pre-trial and court proceedings. If consent is withdrawn for data required to arrange the tour, the Company reserves the right to terminate the Contract, applying the consequences set out in the booking cancellation terms.
5. Cookies and tracking technologies
5.1. Purpose of cookies: The Website uses cookies and similar technologies to provide basic functionality (sessions, the booking form), remember user settings and collect statistical data. 5.2. Categories of cookies used: • Technical (essential): required for the Website to work correctly, for navigation and for submitting requests; • Analytical: allow user behaviour to be analysed to improve service quality, and are processed in anonymised form (Google Analytics and others). 5.3. Managing cookies: The User may disable or restrict the storage of cookies in their browser settings. Disabling technical cookies may cause certain Website services to work incorrectly.
6. Transfer to third parties and cross-border transfer
6.1. Transfer of data to third parties: To fulfil the Client’s requests, perform contractual obligations and operate the Website, the Company may transfer personal data to the following categories of third parties: • Direct service providers: air and rail carriers, global distribution systems (GDS), accommodation providers (hotels), partner tour operators, destination management companies (DMC), transport and transfer companies; • Service and visa bodies: diplomatic missions, consular institutions, accredited visa centres and insurance companies; • The Octobank processing centre — for processing cashless payments. The Company does not pass card details to Octobank and receives only the transaction status and identifier from the processor; • IT and analytics providers — web analytics systems, exclusively in the form of anonymised technical data. 6.2. Cross-border data transfer (Art. 14 of Law No. ZRU-547): • The nature of the tourism business involves transferring personal data outside the Republic of Uzbekistan (to the territory of foreign states) in order to book international flights, accommodation, transfers and other services along the trip itinerary. • By requesting a booking, submitting a request through the Website or accepting the Public Offer (concluding the Contract), the User/Client gives their express, informed and unconditional consent to the cross-border transfer of their personal data, and that of the co-travellers they name, to the destination and transit countries of the selected tour. • The Client is informed of and agrees that cross-border transfer may also take place to foreign states that do not ensure an adequate level of protection of the rights of personal data subjects, where such transfer is necessary to issue tickets, confirm hotel bookings and perform the Contract. 6.3. Safeguards and limitations: Data is transferred to third parties strictly to the minimum extent necessary to provide the specific tourism or related service. The Company does not sell, rent out or otherwise commercially distribute personal data to third parties.
7. Final provisions and changes to the Policy
7.1. Amendment procedure: This Policy takes effect from the moment it is published on the Website and is valid indefinitely. The Company reserves the right to amend the Policy unilaterally. A new version takes effect from the moment it is posted on the Website, unless the new version provides otherwise. Continued use of the Website after updates are published means the User agrees to the new version. 7.2. Relationship with the Contract: This Policy is an integral part of the Public Offer (Contract for tourism services) posted on the Company’s Website. 7.3. Operator contact details: • OKS TOURS Limited Liability Company • E-mail for personal data matters: support@okstours.com • Address: Republic of Karakalpakstan, Nukus, Hawa Joly makhalla, A. Dosnazarov St., 141/2
Questions about privacy?
Contact us if you have questions about protecting your data
support@okstours.com